CVE-2024-42459

CVE-2024-42459 describes a signature malleability vulnerability in Elliptic package 6.5.6 for Node.js, specifically affecting the indutny elliptic product. This medium-severity vulnerability (CVSS 5.3) arises from a missing signature length check in EDDSA, allowing zero-valued bytes to be removed or appended, potentially leading to information disclosure (C:L). The attack vector is network-based with low complexity and no user interaction required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.